Browse public community intelligence reports, source analysis, and threat research.
37 intel reports
Threat actors including APT29 and North Korean-linked campaigns are increasingly misusing trusted collaboration platforms like Slack and Microsoft Teams for identity phishing, credential theft, and persistence.
Void Dokkaebi targets developers with fake job interviews to plant self-propagating malware and commit-tampering scripts in code repositories.
The Manic Android malware family targets financial and government services, utilizing unique Wi-Fi and Bluetooth mesh networks to exfiltrate data from offline devices.
The ServiceNow Red Team developed Dark, an open-source Mythic C2 agent written in Crystal that features in-memory Beacon Object File (BOF) execution for macOS and Linux.
HoneyMyte (Mustang Panda) has updated the CoolClient backdoor with a signed kernel-mode rootkit, msagent.sys, to hide and protect malicious artifacts on Windows systems.
Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.
Russian-linked DOUBLECUP Loader-as-a-Service facilitates ClickFix campaigns delivering CountLoader and a new blockchain-resolving RAT named DeviceManager.
UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.
The Pluto Hephaestus threat actor utilizes the AI-powered 'Hephaestus' framework to automate the full attack lifecycle against government and educational targets in Southeast Asia and South Korea.
Threat actor UAT-11764 and ransomware groups Sinobi and Warlock are weaponizing QR phishing and legitimate RMM tools like MeshAgent to bypass MFA and maintain persistent access.
